RSI Security

Rethinking Your Cybersecurity

Category: Compliance Standards

Staying informed about all of the cyber security compliance standards is essential to keeping your company safe from hackers. Read on to learn about the various steps you can take to stay up to date with your industry’s compliance standards.

  • What Is the NYDFS Cybersecurity Regulation?

    What Is the NYDFS Cybersecurity Regulation?

    While breaches revealing public information (like pictures or emails) are concerning, the prospect of a financial breach tends to instill a higher level of panic. Additionally, accountability becomes even more important as more of these breaches occur. People want guarantees that their financial information is protected to the greatest extent possible.

    Consequently, New York took a step toward greater security by enacting the 23 NYCRR 500 regulation, which focuses on cybersecurity for financial institutions. Do you know about the NYDFS cybersecurity regulations or how they affect you? Find out now with our comprehensive blog post.

    (more…)

  • Do I Need To Appoint A Data Protection Officer?

    Do I Need To Appoint A Data Protection Officer?

    Breaches in the confidentiality of personal information gathered in the regular course of commercial or business activities have been in the news for many years with little to no compliance action until recently.  

    The implementation of the General Data Protection Regulation (GDPR) on May 4th, 2016 was put into motion on May 25th, 2018 and has since been an integral part in keeping personal and sensitive data safe from those who wish to use it maliciously.  

    GDPR has evolved through the first full year of application, making it much more difficult for many companies to stay compliant and stave off colossal fines within GDPR regulations (Google included).  

    Many American-based companies feel that since the original terms of GDPR were drawn up for the European data market that they do not apply to their company. Unfortunately, many organizations’ digital operations exist in a globally manufactured web of platforms that fall under the jurisdiction of this data protection regulation, GDPR.

    A plethora of global companies are searching high and low for sustainable solutions, to realize that the key to data protection compliance has been baked into GDPR all along.  That solution lies with a company’s Data Protection Officer (DPO).  This article will serve as a high-level understanding of a DPO’s role as it pertains to a data protection officer GDPR requirements and responsibilities, how to hire a good DPO, and which organizations and legal entities are required to appoint a DPO.

    (more…)

  • What is PCI P2PE?

    What is PCI P2PE?

    Need for Payment Cardholder Data Protection

    There have been 2,216 confirmed data breaches in 2018. 76% of breaches were financially motivated. Cybercriminals are increasingly becoming more sophisticated. Data breach preparedness among the companies are at an alltime high. 324 data breaches involved stealing credit card data at the Point of Sale (POS) where card-present retail transactions are conducted. 414 credit card data breaches involved targeting payment web applications.

    There’s one common security vulnerability leading to these payment cardholder data breaches at the POS and within web applications: Lack of payment cardholder data encryption.

    PCI Point to Point Data Encryption (P2PE) to the rescue!

    (more…)

  • What is a Token Service Provider?

    What is a Token Service Provider?

    When it comes to ensuring that only authorized personnel are allowed into systems remotely, one of the best ways is to use a token. When it comes to keeping Credit Card Holder Data protected, one of the best solutions is tokenization. Many options exist for token use as well as for tokenization. We will discuss the basics of tokens, tokenization, and token service providers (TSPs) below.

    (more…)

  • Protecting Telephone-Based Payment Card Data

    Protecting Telephone-Based Payment Card Data

    Protecting payment card data is essential in all environments, including when card data is taken over the telephone. Areas of organizations that interact with sensitive data in a telephone-based environment are particularly susceptible to fraud or theft of cardholder data. As such, protecting telephone-based payment card data is essential for all businesses that conduct transactions over the phone.

    (more…)

  • How To Choose The Right Approved Scanning Vendor For Your Company

    How To Choose The Right Approved Scanning Vendor For Your Company

    Making the choice for an approved scanning vendor (ASV) is an important consideration for organizations looking to achieve or maintain compliance with the Payment Card Industry (PCI) requirements. The requirements set forth in the PCI Data Security Standards (PCI DSS) are intended to provide end-to-end security for cardholder data. A central component of the PCI DSS is the requirement for entities covered by the PCI DSS to have regular external scans of their networks and systems. As such, PCI approved scanning vendors occupy a central role in ensuring that organizations covered by PCI DSS achieve and maintain compliance advisory services with these requirements over time.

    (more…)

  • ASV Scanning Responsibilities

    ASV Scanning Responsibilities

    You have determined that you need vulnerability scanning from an approved scanning vendor (ASV), probably because you need to maintain or establish PCI compliance. Most businesses require at least quarterly scanning. You have done your research and selected a vendor, verified they are approved on the PCI website and are ready to get started. There are several parties involved in this process from the Card Brands to the merchant and the ASV. We will discuss the responsibilities of each.

    (more…)

  • Overview of the FISMA Certification and Accreditation Process

    Overview of the FISMA Certification and Accreditation Process

    Source: Kaspersky Lab Daily

    When your grandparents used to lament about security or warn you to lock your doors at night that was as far as the concept of “security” went. No one thought an intruder could penetrate a location without physically breaking down doors. Yet today, bank robbers can steal millions of dollars from the comfort of a desk chair. On a household level, this unauthorized accessibility sounds concerning, but when considered by government agencies, the threat is terrifying. While average households possess a small amount of valuable information, governments store millions of records, usually of a sensitive nature. Realizing the potential implications of remote threats, the U.S. Government developed a set of cyber security guidelines called the Federal Information Security Management Act (FISMA). Are you looking to achieve FISMA compliance? Continue reading for an overview of the FISMA certification and accreditation process.

    (more…)

  • The Three Levels Of Compliance For FISMA

    The Three Levels Of Compliance For FISMA

    The Federal Information Security Act (FISMA) was introduced in 2002 to ensure that all government vendors, contractors, and partners handle confidential and sensitive information appropriately, intending to provide protection against various security threats. Depending on the nature of your business, you’re going to need to reach specific levels of compliance to avoid FISMA fines, penalties, and consequences.

    (more…)

  • Penalties for Non-Compliance with FISMA (and how to avoid them)

    Penalties for Non-Compliance with FISMA (and how to avoid them)

    No organization takes cyber security and digital privacy as seriously as the U.S. Department of Defense. It’s why the Federal Information Security Management Act (FISMA) was implemented by the DoD, setting data security standards government partners and contractors. Vendors that fail to comply with FISMA could be in for stiff fines and penalties.

    (more…)